2

"ssh-keygen -F " seems to return one host-key for a given hostname (first matched?), and "ssh-keyscan " seems to return all matched, but the order is not clear.

What's the specific difference between the two?

0

From the ssh-keygen(1) manpage:

-H      Hash a known_hosts file.  This replaces all hostnames and addresses with hashed
        representations within the specified file; the original content is moved to a
        file with a .old suffix.  These hashes may be used normally by ssh and sshd, but 
        they do not reveal identifying information should the file's contents be 
        disclosed.  This option will not modify existing hashed hostnames and is 
        therefore safe to use on files that mix hashed and non-hashed names.

and from the ssh-keyscan(1) manpage:

-H      Hash all hostnames and addresses in the output.  Hashed names may be used 
        normally by ssh and sshd, but they do not reveal identifying information should
        the file's contents be disclosed.

The former rums locally, hashing your ~/.ssh/known_hosts file, while the latter contacts a remote server to request its keys.

  • Obviously, I meant "-F", rather than "-H". Thank you for your final note, though. The docs don't seem to be explicit about this. – Dustin Oprea Aug 5 '13 at 13:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.